rack cors: configured CORS

* still need to secure production (testing heroku)
updated client